An employee who has resigned starts sending compressed archives of customer records from the corporate mailbox to a personal webmail address. Which control is designed to detect and stop this exfiltration path?
Select an answer to reveal the explanation.
Short Explanation
This one's walking out the front door in an envelope with your logo on it. Outbound DLP opens the envelope, spots customer records, and stops the send. SPF and DKIM are the trap; they prove the mail really came from you, which is exactly what makes it look legitimate.
Full Explanation
Email exfiltration uses the organization's own mail system to send sensitive data to external recipients. Outbound data loss prevention inspects message bodies and attachments, including content inside archives where the archive can be opened, and matches it against policies such as customer record patterns, regulated identifiers or document fingerprints. It can block, quarantine, encrypt or alert on violations, and it can flag patterns such as large archives sent to personal webmail domains. Inbound anti-phishing rules analyze incoming mail from external senders, so they never see messages leaving the organization. SPF and DKIM authenticate the organization's outbound mail to receiving servers; they prevent spoofing of the corporate domain but do nothing to evaluate what an authorized user sends. Antivirus scans look for malware, and customer records in an archive are not malicious code, so the scan would pass the file. Exam caveat: password-protected or encrypted archives can defeat content inspection, so DLP policies often treat unscannable attachments to external recipients as a violation in their own right. Operational check: send a test message containing sample sensitive data to an external address and confirm the DLP policy blocks it and generates an incident.